1. Instant Messaging Security Flaws By: Shadow404 Southern Poly University

2. Major Problems With IM Messaging Software 1. Messages are sent in clear text. 2. File Transfers 3. Conversation Logs 4. Sender Credentials 5. Profile Listings and User Privacy 6. Passwords

3. Messages In Clear Text 1. Allows the inexperienced hacker to use a packet sniffer to read conversations. 2. All buddy list updates are sent in clear text. 3. Confidential information could be discussed in clear text.

4. File Transfers 1. They allow a medium which by is easier to fake a reputable file than over e-mail. 2. Most instant messaging software does not warn the user of the danger of accepting file transfers. 3. Most users will accept and open these files without second thought.

5. Conversation Logs 1. If a computer is compromised, logs can be obtained which could hold incriminating, sensitive, or harmful information. 2. With some clients, by default, logs are kept without asking if its ok. 3. Logs can be altered and then used as incorrect evidence, convicting someone of something that was not really discussed.

6. Sender Credentials 1. How do you know for sure that the person sending the message is really the person you think it is? 2. Man in Middle Attacks. 3. PGP key. 4. Unique User Identification.

7. Profile Listings and User Privacy 1. Many users list everything you’ve ever wanted to know about a person. 2. For example, on AIM, the profile asks for your whole name, address, zip, state and country. 3. So how easy is it to then reverse this information and find out all you wanted to know about someone online?

8. Passwords 1. Stored passwords pose a huge security risks, because the passwords have to be stored somewhere on the machine. 2. Like the clear text example, passwords are sometimes sent in clear text. 3. There is always going to be an inherent risk when passwords are used to gain access to restricted zones.

9. 5 Major Instant Messaging Clients and Some Flaws of Each. Clients that will be discussed: 1. AIM (AOL Instant Messenger) 2. Yahoo Messenger 3. Skype 4. MSN Messenger (Microsoft Network) 5. IRC (Internet Relay Chat)

10. AIM 1. Messages are sent in clear text. 2. Buddy list updates are received in clear text. 3. By default, anyone can see you logon as well as pull up buddy info on you. 4. All conversations have to go through an AIM central server, which makes the clear text conversations even more vulnerable if

11. AIM (cont.) AIM (cont.) 4.(cont.) a hackers were able to pull off a successful server side hack, which could leave any user of AIM open to eavesdropping. 5. Buffer overflow issues, redirect to URL to where more malicious code can be downloaded. (http://www.aim.com/help_faq/security/faq.adp?a olp= )http://www.aim.com/help_faq/security/faq.adp?a olp= 6. Man in the Middle password hack vulnerability.

12. Yahoo Messenger 1. Messages are sent in clear text. 2. Buddy list updates are also sent in clear text. 3. In some versions of the client software, a buffer overrun vulnerability has been reported using an active-x control to download malicious code from a web-site. (http://www.pcworld.com/news/article/0,aid,113723, 00.asp)http://www.pcworld.com/news/article/0,aid,113723, 00.asp

13. Skype 1. Messages are sent directly to the other party rather than through a server. 2. This is a problem because you IP# number is not hidden from the receiving party. 3. Certain versions of Skype are also vulnerable to buffer overflow problems. (http://www.skype.com/security/ssa-2004- 02.htm )http://www.skype.com/security/ssa-2004- 02.htm 4. Logs are kept by default without asking.

14. MSN Messenger 1. Messages sent in clear text. 2. Remote Code Exploitation: http://www.microsoft.com/technet/securit y/bulletin/MS05-009.mspx http://www.microsoft.com/technet/securit y/bulletin/MS05-009.mspx

15. IRC 1. Messages are sent in clear text. 2. Many vulnerabilities have been identified. 3. Third-party scripts and bots sometimes have malicious code that runs on a users machine. http://www.irchelp.org/irchelp/security/ http://www.irchelp.org/irchelp/security/ 4. DCC file transfer security flaws. 5. IP address publicly displayed.

16. What can you do to secure your system? 1. Keep your software up-to-date. 2. Do not talk about anything sensitive (I.e. Credit card #’s, telephone #’s, financial information, etc) using instant messaging software. 3. Institute a security lockdown or filtering of instant messaging conversations in a business environment.

17. What can you do to secure your system? (cont) 4. Change your passwords regularly. 5. Ensure the person you are talking to is really the person you think it is. (Ask personal questions that only they would know if you suspect an imposter, or call the person in question to verify.) 6. Use a proxy/bnc to mask your IP. 7. Ensure the firewall is up-to-date and working properly.

18. Credits and Shoutouts Credits: DAD (Joe Klein) Shout Outs: Hacksonville Crew Yak Crew 404-2600 Copy of speech can be found at: www.shadow404.com/111